Bug 1257150 - [RHEL7.2] rsyslog fails to load imuxsock module without imjournal module
[RHEL7.2] rsyslog fails to load imuxsock module without imjournal module
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: rsyslog (Show other bugs)
7.2
Unspecified Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: Tomas Heinrich
Marek Marusic
: Regression
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2015-08-26 07:20 EDT by Marek Marusic
Modified: 2016-09-20 00:52 EDT (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-11-19 09:30:53 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Marek Marusic 2015-08-26 07:20:43 EDT
Description of problem:
Rsyslog fails to load imuxsock module without imjournal module when custom $WorkDirectory specified and $OmitLocalLogging is set to off. 

Version-Release number of selected component (if applicable):
rsyslog-7.4.7-11.el7

How reproducible:
always

Steps to Reproduce:

This is my configuration
1.Edit rsyslog.conf
[root@RHEL7 ~]# cat /etc/rsyslog.conf
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$ModLoad imklog
$ModLoad imuxsock
#Custom WorkDirectory
$WorkDirectory /var/spool/rsyslog
*.info;mail.none;authpriv.none;cron.none                /var/log/messages

2.create WorkDirectory and restore its selinux context
[root@RHEL7 ~]# mkdir -p /var/spool/rsyslog && restorecon -v /var/spool/rsyslog

3.restart rsyslog
[root@RHEL7 ~]# systemctl restart rsyslog

4.log any message
[root@localhost ~]# logger testMSG


Actual results:
Behaviour on RHEL7.2 with rsyslog-7.4.7-11.el7
Imuxsock fails to load and test messages is not logged.

[root@localhost ~]# tail /var/log/messages
Aug 26 13:00:38 localhost rsyslogd: [origin software="rsyslogd" swVersion="7.4.7" x-pid="4262" x-info="http://www.rsyslog.com"] exiting on signal 15.
Aug 26 13:00:38 localhost rsyslogd: [origin software="rsyslogd" swVersion="7.4.7" x-pid="4280" x-info="http://www.rsyslog.com"] start
Aug 26 13:00:38 localhost rsyslogd: cannot create '����x': Permission denied
Aug 26 13:00:38 localhost rsyslogd: imuxsock does not run because we could not aquire any socket

Aug 26 13:00:38 localhost rsyslogd-3000: activation of module imuxsock failed


Expected results:
Behaviour on RHEL7.1 with rsyslog-7.4.7-7.el7_0
Rsyslog starts without error and messages is logged.

Aug 26 07:09:46 RHEL7 rsyslogd: [origin software="rsyslogd" swVersion="7.4.7" x-pid="2716" x-info="http://www.rsyslog.com"] exiting on signal 15.
Aug 26 07:09:46 RHEL7 rsyslogd: [origin software="rsyslogd" swVersion="7.4.7" x-pid="2985" x-info="http://www.rsyslog.com"] start
Aug 26 07:09:59 RHEL7 root: testMSG
Comment 3 Tomas Heinrich 2015-08-28 10:33:28 EDT
(In reply to Marek Marusic from comment #0)
> Description of problem:
> Rsyslog fails to load imuxsock module without imjournal module when custom
> $WorkDirectory specified and $OmitLocalLogging is set to off. 

> [root@localhost ~]# tail /var/log/messages
> Aug 26 13:00:38 localhost rsyslogd: [origin software="rsyslogd"
> swVersion="7.4.7" x-pid="4262" x-info="http://www.rsyslog.com"] exiting on
> signal 15.
> Aug 26 13:00:38 localhost rsyslogd: [origin software="rsyslogd"
> swVersion="7.4.7" x-pid="4280" x-info="http://www.rsyslog.com"] start
> Aug 26 13:00:38 localhost rsyslogd: cannot create '����x': Permission denied
> Aug 26 13:00:38 localhost rsyslogd: imuxsock does not run because we could
> not aquire any socket

I can reproduce a segfault, but the scenario is different:
imjournal, $WorkDirectory and $OmitLocalLogging are completely irrelevant.
The only relevant part is loading imuxsock and _not_ using $SystemLogSocketName.
Using $SystemLogSocketName prevents the segfault.

There seems to be a regression from rsyslog-7.4.7-rhbz1151041-imuxsock-socket-limit.patch.
A one-line change appears to fix the segfault I've observed.

Here's a fixed scratch build to test: http://brewweb.devel.redhat.com/brew/taskinfo?taskID=9761711

Marek, can you confirm this or do you see a different issue?
Comment 4 Marek Marusic 2015-09-02 03:19:08 EDT
(In reply to Tomas Heinrich from comment #3)

> Marek, can you confirm this or do you see a different issue?

Hello Tomas, You are right, _not_ using $SystemLogSocketName is the trigger, but I have tested your new scratch build and the imuxsock still fails to load. The issue is that imuxsock is not loaded. I think it should be loaded.

My new configuration:
[root@RHEL7 ~]# cat /etc/rsyslog.conf
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$ModLoad imuxsock
*.info;mail.none;authpriv.none;cron.none                /var/log/messages


On rsyslog-7.4.7-12 the imuxsock is still not loaded:
[root@RHEL7 ~]# tail /var/log/messages
Sep  2 09:00:28 RHEL7 rsyslogd: [origin software="rsyslogd" swVersion="7.4.7" x-pid="2639" x-info="http://www.rsyslog.com"] exiting on signal 15.
Sep  2 09:00:28 RHEL7 rsyslogd: [origin software="rsyslogd" swVersion="7.4.7" x-pid="2676" x-info="http://www.rsyslog.com"] start
Sep  2 09:00:28 RHEL7 rsyslogd: cannot create '/dev/log': Address already in use
Sep  2 09:00:28 RHEL7 rsyslogd: imuxsock does not run because we could not aquire any socket
Sep  2 09:00:28 RHEL7 rsyslogd-3000: activation of module imuxsock failed


On rsyslog-7.4.7-7 the imuxsock is loaded:
[root@RHEL7 ~]# tail /var/log/messages
Sep  2 03:04:57 RHEL7 rsyslogd: [origin software="rsyslogd" swVersion="7.4.7" x-pid="2360" x-info="http://www.rsyslog.com"] exiting on signal 15.
Sep  2 03:04:57 RHEL7 rsyslogd: [origin software="rsyslogd" swVersion="7.4.7" x-pid="2453" x-info="http://www.rsyslog.com"] start
Comment 5 Tomas Heinrich 2015-09-04 08:56:45 EDT
(In reply to Marek Marusic from comment #4)
> (In reply to Tomas Heinrich from comment #3)
> 
> > Marek, can you confirm this or do you see a different issue?
> 
> Hello Tomas, You are right, _not_ using $SystemLogSocketName is the trigger,
> but I have tested your new scratch build and the imuxsock still fails to
> load. The issue is that imuxsock is not loaded. I think it should be loaded.

So there are actually two issues; first is the segfault and this is another one.

> My new configuration:
> [root@RHEL7 ~]# cat /etc/rsyslog.conf
> $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
> $ModLoad imuxsock
> *.info;mail.none;authpriv.none;cron.none                /var/log/messages
> 
> 
> On rsyslog-7.4.7-12 the imuxsock is still not loaded:
> [root@RHEL7 ~]# tail /var/log/messages
> Sep  2 09:00:28 RHEL7 rsyslogd: [origin software="rsyslogd"
> swVersion="7.4.7" x-pid="2639" x-info="http://www.rsyslog.com"] exiting on
> signal 15.
> Sep  2 09:00:28 RHEL7 rsyslogd: [origin software="rsyslogd"
> swVersion="7.4.7" x-pid="2676" x-info="http://www.rsyslog.com"] start
> Sep  2 09:00:28 RHEL7 rsyslogd: cannot create '/dev/log': Address already in
> use
> Sep  2 09:00:28 RHEL7 rsyslogd: imuxsock does not run because we could not
> aquire any socket
> Sep  2 09:00:28 RHEL7 rsyslogd-3000: activation of module imuxsock failed

I can't reproduce this.

The /dev/log socket is handled by systemd, you shouldn't try to usurp it.
When using "$OmitLocalLogging on" (and _not_ $SystemLogSocketName, which previously triggered the segfault), the package behaves as expected for me.

I, actually, think this is the right reaction to not being able to open the socket (which I can't reproduce here);
there shouldn't be a warning when imuxsock runs without any sockets configured, but when you _do_ try to open some and fail, the warning seems adequate.

So from my POV, the issue is solved. Please try to debug this further and provide more information if you think there still is an issue:

How did you managed to get that error message? I can't get that to happen running rsyslog under systemd or standalone.
How does the behavior change when using "$OmitLocalLogging on"?
Comment 6 Marek Marusic 2015-09-07 04:22:06 EDT
(In reply to Tomas Heinrich from comment #5)

> I can't reproduce this.

I reproduced this on RHEL-7.2-20150820.0. I tried this on a new compose (RHEL-7.2-20150904.0) with your scratch build and it works as expected. 

It looks like the second issue was not rsyslog related. It was probably bug in systemd or selinux (but i did not get any avc messages).

> How did you managed to get that error message? I can't get that to happen
> running rsyslog under systemd or standalone.

I was running rsyslog under systemd.

> How does the behavior change when using "$OmitLocalLogging on"?

When I used "$OmitLocalLogging on" the issue was not reproduced.
Comment 11 errata-xmlrpc 2015-11-19 09:30:53 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-2173.html

Note You need to log in before you can comment on or make changes to this bug.